CVE-2009-0355

components/sessionstore/src/nsSessionStore.js in Mozilla Firefox before 3.0.6 does not block changes of INPUT elements to type="file" during tab restoration…

published February 4, 2009

CVSS
—
EPSS
2%
Percentile
76.1
In the wild
Unconfirmed
What it is

components/sessionstore/src/nsSessionStore.js in Mozilla Firefox before 3.0.6 does not block changes of INPUT elements to type="file" during tab restoration, which allows user-assisted remote attackers to read arbitrary files on a client machine via a crafted INPUT element.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.01635 · 76.1th percentile
Published
2009-02-04T19:00Z
EPSS history
Timeline
  • 04 FEB 19:00Z
    components/sessionstore/src/nsSessionStore.js in Mozilla Firefox before 3.0.6 does not block changes of INPUT elements to type="file" during tab restoration…
    cvelistv5